Description

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s PDF page-tree handling. A specially crafted PDF can trigger page-structure changes during rendering, causing the application to access released page objects and resulting in memory corruption and an application crash.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-23T08:17:12.583Z",
  "pubdate": "2026-09-23T08:17:12.583Z",
  "executiveSummary": "A critical use-after-free vulnerability has been identified within the PDF page-tree handling logic of Foxit PDF Editor and Foxit PDF Reader. This vulnerability arises from improper management of memory during the rendering of malformed PDF page structures, leading to potential memory corruption.\nSuccessful exploitation of this flaw allows a remote, unauthenticated attacker to execute arbitrary code or cause a denial-of-service condition by crashing the application. The impact is significant, as it can lead to full system compromise if leveraged to achieve remote code execution. Exploitation requires an attacker to convince a user to open a specially crafted PDF document. Given the widespread use of Foxit software, the risk to enterprise and consumer environments is high, necessitating immediate defensive measures and patching where available.",
  "technicalDetails": "The vulnerability resides in the core component responsible for parsing and rendering the PDF page-tree hierarchy within Foxit PDF Editor and Foxit PDF Reader. The root cause is a use-after-free (UAF) condition triggered during the dynamic mutation of page-structure objects while the rendering engine is active.\nDuring the rendering lifecycle, the application processes page-tree nodes to map visual representations. A specially crafted PDF can manipulate these objects, forcing the engine to initiate a structural change that prematurely deallocates specific page objects while the rendering thread or associated parser continues to hold dangling pointers to these memory addresses.\nThe attack flow proceeds as follows: First, the attacker embeds a malicious PDF structure containing carefully ordered page-tree directives that trigger an object update or deletion event during the initial parsing phase. As the engine attempts to resolve object references for layout, the application executes a free operation on the object while the reference remains active in the rendering cache. When the engine subsequently accesses the memory location previously occupied by the freed object, the application performs an invalid memory access. Because the heap space may have been partially reclaimed or reallocated by the time the dangling pointer is dereferenced, the state of the application becomes non-deterministic.\nFrom an exploitation perspective, an attacker can leverage this UAF by employing heap spraying techniques to populate the freed memory region with attacker-controlled data. By carefully timing the heap allocations, the attacker can hijack the application's control flow, potentially diverting execution to shellcode or ROP chains. This process does not require authentication or elevated privileges, as it is triggered solely by the act of parsing the malicious document. The memory corruption can result in arbitrary code execution within the context of the user running the application, facilitating post-exploitation activities such as data exfiltration or lateral movement within the network. Because this flaw is inherent in the document handling logic, it is particularly effective against standard user installations with default security configurations."
}